/var directory always full:

[sassou]

Thank you


The var directory /var is full
specialy /var/adm/crash
When the /var directory attempt 100% The node is unreachble and the listener and connetion fail.
I remove some file whith sam and the system continue until the node crash again.
Could I clean all the crash directories?
I need help.
I after the crash I can restart normaly
Startup process block on the entry
"
Save system crash dump if needed ...................................."
I start the server in single user mode.
Help me

[Ingo Duschl]

hello,

look at the path of the crash files and change it somewhere with more space.

[Cheryl Griffin]

Remove old crash directories. If you have had the crash files analyzed, remove all crash directories.

Look for misplaced files which should not be in /var. (Stray user generated files).
Use SAM and trim system log files.
Remove *.old *.bak *.sav files or relocate them elsewhere.
Clear /var/tmp. Set up a cron job to routinely purge this directory.
Commit superseded patches.
Run cleanup on patches.
Remove files named "core".

There are many suggestions that can be made to manage /var.

[Mobeen_1]

KUZO,
I am afraid that some application/process is writing a crash dump on /var. So you need to find out which one is crashing and then remove the crash files and take up the issue of why that particular process/application is crashing.

regards
Mobeen

[Robert-Jan Goossens]

Hi,

Cleanup the /var/adm/crash ( or if you like to keep the information, move it to another filesystem)

# mount -a
# cd /var/adm/crash
# find . -exec rm {} \;

Regards,
Robert-Jan

[Bill Hassell]

Unless you have a very badly written application, /var/adm/crash is ONLY written whne your computer crashes (a bad thing, usually due to lack of patches). If you remove the entire directory and all the contents, when your computer crashes again there will be no crash dump. If you do not wnat or need to figure out the reason for the crash, this is a simple solution. However, since you mentioned listener, you are probably running Oracle and that is usually an important application to keep running. /var cannot be allowed to fill up as you've seen. This takes regularly sysadmin monitoring to keep under control.

[Lorenzo Facello]

Hi,
try to clean the previous crash.
leave the last one...maybe you need this
to analize your crash (by hp tec)

find all big logs anf file... surely you not need all
take a look also at core files!
Hope this helps
LF

[Geoff Wild]

You can remove those files in /var/adm/crash - while you are at it, I like to make /var/adm/crash a seperate filesystem - that way you won't fill up /var....

Another thing to check - /var/adm/sw/save - is there a lot of patches there? maybe clean them up too:

cleanup -c 1


Rgds...Geoff

[Michael D'Aulerio]

If you don't know how to read the crash files or have no intention of using them, you can disable the save by setting SAVECORE=0 in /etc/rc.config.d/savecore. I find that unless you have HP's tools, there's not much you can get from the crash files.